CVE-2020-11981 in the critical feed json
Command injection via Celery broker in Apache Airflow
published 2020-07-16 6 y ago modified 2026-09-08 2 mo ago also BIT-airflow-2020-11981 , EUVD-2020-0033 , GHSA-976r-qfjj-c24w , PYSEC-2020-15
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 36.8%
- EPSS 36.8% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.
Patch / fix
- pypi apache-airflow 1.10.11rc1
- bitnami airflow 1.10.11
Exploit prediction
36.79% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Apache Airflow <=1.10.10 - Command Injection nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow | <1.10.11rc1 |
1.10.11rc1 |
| bitnami | airflow | <1.10.11 |
1.10.11 |
Affected products
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/apache/airflow/commit/1dda6fdde7c6bcaf0d6534786beeeba868006dd2
web
-
github.com
/apache/airflow/commit/afa4b11fddfdbadb048f742cf66d5c21c675a5c8
web
-
lists.apache.org
/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E
web, mailing-list, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-11981
advisory, web
-
github.com
/advisories/GHSA-976r-qfjj-c24w
advisory
-
github.com
/apache/airflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-15.yaml
web
-
web.archive.org
/web/20220427031325/https://issues.apache.org/jira/browse/AIRFLOW-6351
web
Sources
- CVE List CVE-2020-11981
- GitHub Advisory GHSA-976r-qfjj-c24w
- NVD CVE-2020-11981
- OSV BIT-airflow-2020-11981
- OSV PYSEC-2020-15
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.